Shenzhen Hichip Vision Technology V20 up to 2020 P2P Service buffer overflow

Summaryinfo

A vulnerability was found in Shenzhen Hichip Vision Technology V6, V7, V8, V9, V10, V11, V12, V13, V14, V15, V16, V17, V18, V19 and V20 up to 2020. It has been rated as critical. This affects an unknown function of the component P2P Service. Performing a manipulation results in buffer overflow. This vulnerability was named CVE-2020-9527. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in Shenzhen Hichip Vision Technology V6, V7, V8, V9, V10, V11, V12, V13, V14, V15, V16, V17, V18, V19 and V20 up to 2020. This affects an unknown function of the component P2P Service. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20, after 2018-08-09 through 2020), as used by many different vendors in millions of Internet of Things devices, suffers from buffer overflow vulnerability that allows unauthenticated remote attackers to execute arbitrary code via the peer-to-peer (P2P) service. This affects products marketed under the following brand names: Accfly, Alptop, Anlink, Besdersec, BOAVISION, COOAU, CPVAN, Ctronics, D3D Security, Dericam, Elex System, Elite Security, ENSTER, ePGes, Escam, FLOUREON, GENBOLT, Hongjingtian (HJT), ICAMI, Iegeek, Jecurity, Jennov, KKMoon, LEFTEK, Loosafe, Luowice, Nesuniq, Nettoly, ProElite, QZT, Royallite, SDETER, SV3C, SY2L, Tenvis, ThinkValue, TOMLOV, TPTEK, WGCC, and ZILINK.

The weakness was presented 08/10/2020. This vulnerability is uniquely identified as CVE-2020-9527 since 03/01/2020. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 08/10/2020).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-159455 and VDB-159454 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Accfly
• Alptop
• Anlink
• Besdersec
• BOAVISION
• COOAU
• CPVAN
• Ctronics
• D3D Security
• Dericam
• Elex System
• Elite Security
• ENSTER
• ePGes
• Escam
• FLOUREON
• GENBOLT
• Hongjingtian (HJT)
• ICAMI
• Iegeek
• Jecurity
• Jennov
• KKMoon
• LEFTEK
• Loosafe
• Luowice
• Nesuniq
• Nettoly
• ProElite
• QZT
• Royallite
• SDETER
• SV3C
• SY2L
• Tenvis
• ThinkValue
• TOMLOV
• TPTEK
• WGCC
• ZILINK

Productinfo

Vendor

• Shenzhen Hichip Vision Technology

Name

• V6
• V7
• V8
• V9
• V10
• V11
• V12
• V13
• V14
• V15
• V16
• V17
• V18
• V19
• V20

Version

• 2020

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion